Weaver Network e-cology 10.0/2026-03-31 POST Request method interfaceName/methodName missing authentication

Summaryinfo

A vulnerability marked as critical has been reported in Weaver Network e-cology 10.0/2026-03-31. This affects an unknown function of the file /papi/esearch/data/devops/dubboApi/debug/method of the component POST Request Handler. Performing a manipulation of the argument interfaceName/methodName results in missing authentication. This vulnerability is reported as CVE-2026-22679. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Weaver Network e-cology 10.0/2026-03-31. This affects an unknown code of the file /papi/esearch/data/devops/dubboApi/debug/method of the component POST Request Handler. The manipulation of the argument interfaceName/methodName with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

The advisory is shared at weaver.com.cn. This vulnerability is uniquely identified as CVE-2026-22679 since 01/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a exploit are known. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/07/2026).

It is declared as highly functional.

Upgrading to version 20260312 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-19607). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Weaver Network

Name

• e-cology

Version

• 10.0
• 2026-03-31

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion